Summary

• Accomplished Information Security Expert with practical experiences in incident response investigation, cyber threat vulnerability management operations. A pioneer who designed the cyber threat vulnerability management services for the US Central Bank. US Citizen, fluent Cantonese and English.
• Tenacious Investigator: Detected a major security breach at an online brokerage. Informed senior leaders, orchestrated a complex, 4 - month investigation, and exposed the theft of highly sensitive trading secrets.
• Innovator: Devised a plan to consolidate cyber threat management for all 12 Federal Reserve banks via creation of a centralized threat management body. Later rehired by the Fed to implement this plan.
• Team Leader: Recruits and motivates top-performing security teams. Leverages the top strengths of each team member. Coaches and trains winning teams in both business and performance driving education.
• Intrusion Detection/Prevention IDS/IPS IS Incident Response Strategic IS Service / Business Planning 24/7 Security Operation Center SOC IT IS Security Advisory Security / IT Risk Metric Reporting Application Infrastructure Security Forensic Investigations SEIM Operations Identity / User Access Controls Security Awareness Training Penetration Testing

PROFESSIONAL EXPERIENCE

Confidential

Information Security Manager

• Background and Scope: When SocGen became a bank holding company, all of its operations especially security, SOX compliance were suddenly being audited by FRBNY employer during .
• Introduced SG's first data-protection program and developed a security incident response and investigation service for US, Canada, and Brazil. Collaborated closely with corporate counsel HR during implementation.
• Implemented and tested SG AMER's first IS security incident response program.
• Appointed primary liaison with Paris HQ on all matters related security incident management.
• Managed a small team of 3 in US on various GRC activities.
• Cyber Threat Initiatives: Presented the first company-wide Cyber Security Awareness session for US, Canada Brazil staffs. Combining operational, technology and cyber risks KPI/KRI metrics to illustrate potential emerging threat against SocGen internal asset.
• Cultural Change: Enforced security, and corrected numerous compliance and controls deficiencies, both large and small. Customized security awareness training tailor to specific business lines.
• Metrics and Results: Adapted a set of metrics that accurately assesses ongoing improvement. During, IS improved 90 with new data protection awareness program. Successfully recovered information assets lost 1 2, and protected SG reputational risk.

Confidential

Senior Information Security Analyst and Special Investigator

• National Incident Response Team is based at the NY Fed, but actually responsible for IS for the Federal Reserve Systems and Federal Reserve Banks FRBs an exceptional security challenge, because the 12 Fed banks are quasi-independent entities.
• Designed and implemented infrastructure security for the new FRB Kansas City HQ, several branch offices processing centers, and two major US Treasury fiscal services.
• Acted as point of contact to Board of Governor BOG and General Accounting Office GAO auditors for security operations.
• Managed 500,000 vendor support contacts and numerous projects with total value over 1 million. Managed and grew the cyber threat operation throughout .
• Maintained ISO 2 certifications
• Key Projects: Standardized cyber threat mitigation services for all 12 FRBs a consolidation that took over 2 years which provided a single and unobstructed view of entire security landscape for FRBs. Eliminated email spam and computer virus problems.
• Established First SEIM and SOC: Set up the Security Event and Incident Management system. Staffed and trained personnel for SOC. Expanded SOC operation and capabilities from 9/5 to 24/7/365.
• Leadership: Leaded a team of network engineers that cover 65 remote locations. Manage a four-member security operations team backed by 35 technicians that support a 300 node IDS/IPS.
• Staff Management Roles: Directed a team of 3 in NY, 1 in San Francisco, and 100 matrix-managed staff across 65 locations. During, steadily expanded scope of influence despite several reorganization of security function. Led numerous IS innovations:
• Designed and implemented turnkey Antivirus/Anti-spam solutions for the FRBs.
• Co-designer of the Management Network, an enterprise level IT service for all network system administration for FRBs resources.
• Created the first Knowledge Management KM system based on Xerox DocuShare, which actively preserved knowledge and lessons learned from daily operations.
• Co-defined business requirement for vulnerability management tools RSA Archer SEIM ArcSight .
• Led cyber-investigations and operation-forensic reviews .
• No loss of FRB properties or major cyber security incidents.

Confidential

Senior Information Security Analyst

• Background and Scope:
• Defined the operating procedures for security monitor, IDS operation, and event escalation. Reviewed perimeter network security. Performed checkpoint firewall admin and trend analyses.
• Defined Windows NT, 2000, and Solaris 8 secured-operation procedure. Performed security audits on web-based equity- trading products.
• Introduced IS standards into Instinet and moved toward compliance with BS7799 ISO 9000:27000 . For example, prior to 2001, the idea of data classification did not exist.
• Investigated a Complex Theft of Instinet's Highly Sensitive Business Applications:
• Found an intrusion via IDS, which flagged an unauthorized communication between points A and B.
• Devised a reverse-engineering strategy to break down the messages. Discovered the intruder was stealing one byte of code at a time. Analyzed the scheme by reading raw TCP data by glancing at pages.
• Enlisted support of top management, persisted with the investigation, unraveled the fraudulent scheme, and pinpointed the perpetrator. Investigation took 4 months.
• Implemented First IDS: Implemented the first Intrusion Detection System at Instinet for US, UK, and Tokyo. Explained the system and its capabilities.
• Built a new IS Function in London and Tokyo Offices: Built IS capabilities remotely.

Confidential

Computer Security Specialist

• Background and Scope: In the 1990s, the Federal Reserve was not connected to the Internet and the IS program was mostly focused on mainframe access control.
• Mastered implementation and analysis of computer vulnerability assessments. Conducted the first web-application penetration testing at NY Fed in collaboration with external consultants .
• Performed white hat versus black hat vulnerability tests.
• Evaluated security products and conducted operating system reviews.
• Management Roles: Quickly promoted 3 times. Managed a 5-person team that continually improved all security for the NY Fed.
• Major Proposal: After first year, identified that a comprehensive cyber security service a consolidation of all FRBs threat management functions was necessary to address security needs facing all FRBs.
• Championed drafted a proposal to consolidate cyber threat management for all that was eventually adopted.
• Returned to the NY Fed in 2003 to implement this proposal, which became an urgent matter after 9/11.
• Introduced Intrusion Detection IDS : First saw the idea at DEFCON6, followed-up with software vendors and implemented an incident response process.
• Implemented Fed's First IS Standards: Achieved compliance with ISO standards BS7799 ISO 9000/27000 the first time a US agency was certified under a foreign standard.